AtlasRAT is a modular Windows remote access trojan that uses a four-stage, fully in-memory loader chain to quietly establish TLS‑ and ChaCha20‑protected command-and-control, log keystrokes offline. If inject malicious DLLs into WeChat, effectively turning the chat client into a long‑lived surveillance and control foothold on compromised hosts. Once launched, this first stage decrypts and loads […]
The post AtlasRAT Uses Four-Stage In-Memory Loader to Keylog and Inject Malware Into WeChat appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.
These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.
CISA recommends organizations implement the following mitigations:
After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity.
To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance:
For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector or your CISA Regional Office.
To report a cyber incident, contact CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or call 1-844-Say-CISA (1-844-729-2472). Please see Reporting a Cyber Incident for more details or contact FBI’s Internet Crime Complaint Center (IC3) or your local FBI field office.
When available, please include the following information regarding the incident:
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.
AcknowledgementsThe Environmental Protection Agency and the Federal Bureau of Investigation contributed to this Alert.